Which of the following functions implements and oversees the use of controls to reduce risk when creating an information security program?

Question

Options

• ARisk Assessment
• BIncident Response
• CRisk Management
• DNetwork Security administration

• A
  13% (8)
• B
  3% (2)
• C
  78% (47)
• D
  5% (3)

Explanation

Risk Management (C) is the function that encompasses the full lifecycle of identifying, assessing, and applying controls to reduce risk - it's the overarching program that implements and oversees risk-reducing controls, making it the correct fit for "creating an information security program."

• A (Risk Assessment) is only one phase within Risk Management - it identifies and evaluates risks but does not implement or oversee controls.
• B (Incident Response) is reactive, dealing with security events after they occur, not proactively applying controls to reduce risk.
• D (Network Security Administration) is a technical discipline focused on managing network infrastructure - a tactical tool, not a governance function that oversees controls program-wide.

Memory tip: Think of Risk Management as the umbrella. Risk Assessment, controls selection, and monitoring all live under it. If a question asks about the function that oversees or governs risk reduction, the answer is almost always the management layer, not a specific activity or domain beneath it.

No community discussion yet for this question.